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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF THE DISTRICT OF COLUMBIA 



DANIEL KENNEDY, 
1717 H Street 
Areata, CA 95521, 
on behalf of himself 
and all others similarly 
situated 



Plaintiff, 



vs. 



UNITED STATES DEPARTMENT 
OF VETERANS AFFAIRS, 
810 Vermont Avenue NW 
Washington, DC 20420, 

R. JAMES NICHOLSON, Secretary 
of the United States Department of 
Veterans Affairs, officially and 
individually, 

810 Vermont Avenue NW 
Washington, DC 20420, 

GORDON G. MANSFIELD, Deputy 
Secretary of the United States 
Department of Veterans Affairs, 
officially and individually, 
810 Vermont Avenue NW 
Washington, DC 20420, 

and 

JOHN DOE, employee of the 

United States Department of 

Veterans Affairs, officially and 

individually, 

c/o 810 Vermont Avenue NW 

Washington, DC 20420. 

Defendants. 



CASE NO. 



CLASS ACTION COMPLAINT 
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I. PRELIMINARY STATEMENT 

1 . Plaintiff Daniel Kennedy brings this action pursuant to the Privacy Act of 1974 
and the Fourth and Fifth Amendments to the United States Constitution on behalf of himself 
and all others similarly situated against the United States Department of Veterans Affairs 
("VA"), Secretary R. James Nicholson, Deputy Secretary Gordon H. Mansfield, and its 
employee, John Doe. 

2. Plaintiff, a veteran of the United States Army, is one ofmore than 26.5 million 
military veterans whose private personal information, including Social Security number, was 
improperly, unlawfully, willfully and intentionally disclosed in at least three ways: (1) 
through the access and removal of data files containing the private personal information of 
26.5 million veterans from the VA facility by employee John Doe; (2) through the transfer of 
the data to external and unprotected disks and/or computers by John Doe; and (3) through the 
alleged theft of these disks and/or computers by a third party, the identity of whom may 
never be known. These disclosures, made without Plaintiffs knowledge or consent, violate 5 
U.S.C. § 552a{b). 

3. These disclosures were the direct and proximate result of Defendants' willful and 
intentional failure to establish and enforce appropriate safeguards to ensure the security and 
privacy of veteran records and to protect against any known or anticipated threats or hazards 
to the security and integrity of these records in violation of 5 U.S.C. § 552a{e)(10). 

4. Subsequent to learning of these disclosures, Defendants were deliberately 
indifferent in failing to take reasonable corrective action, including but not limited to, 
providing prompt and accurate notification of the disclosures to law enforcement and the 
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affected veterans despite knowledge of the substantial risk of serious harm to the personal 
and financial security of the affected veterans as result of the disclosures. 

5. Defendants' disclosures of Plaintiff's confidential Social Security number also 
violated PlaintifTs right to privacy and personal security of his Social Security number under 
the Fourth and Fifth Amendments of the United States Constitution, 

6. As result of the Defendants' acts and omissions in disclosing and failing to protect 
Plaintiffs private personal information, including his Social Security number, Plaintiff and 
those similarly situated have been placed at a substantial risk of harm in the form of identity 
theft and have incurred and will incur actual damages in an attempt to prevent identity theft 
by purchasing services to monitor their credit information. The remedies sought include 
declaratory and remedial injunctive relief, damages and reasonable attorneys' fees and costs. 

II. JURISDICTION AND VENUE 

7. The jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1331. Federal 
jurisdiction is appropriate in this instance to secure protection and to redress deprivations of 
rights guaranteed under 5 U.S.C. § 552a 

8. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. § 
1391(6). 

III. PARTIES 

9. Plaintiff Daniel Kennedy is a veteran of the United States Army honorably 
discharged from service in 2002. He is a resident of Areata, California. 

10. Defendant VA is a cabinet of the executive branch of the United States 
Government which, in the course of its duties, compiles and maintains records of all 
individuals discharged from a branch of the United States militar>" and provides benefits and 
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services to veterans, including among other things, pension payments and health care. 

11. Defendant R. JamesNicholsonis the duly-confirmed Secretary of United States 
Department of Veterans Affairs and is responsible for the enactment and enforcement of all 
VA policies and procedures, including those pertaining to safeguards to ensure the security 
and privacy of veteran records and to protect against any anticipated threats or hazards to the 
security and integrity of these records. He is sued in his official and individual capacities. 

12. Defendant Gordon H. Mansfield is the duly-appointed Deputy Secretary of the 
United States Department of Veterans Affairs and is responsible for the enactment and 
enforcement of all VA policies and procedures, including those pertaining to safeguards to 
ensure the security and privacy of veteran records and to protect against any anticipated 
threats or hazards to the security and integrity of these records. He is sued in his official and 
individual capacities. 

1 3 . Defendant John Doe is a long-time employee of the VA who was assigned as a 
data analyst. Upon information and belief, John Doe engaged in conduct tantamount to a 
willful and intentional disclosure of and failure to protect the private personal information of 
Mr. Hackett and 26.5 million other veterans. He is sued in his official and individual 
capacities. 

IV. STATEMENT OF FACTS 

14. In connection with his honorable discharge after service with the United States 
Army, Plaintiff was required to provide the VA with his private personal information, 
including Social Security number. 

15. On or about May 22, 2006, Secretary Nicholson publicly announced through 
worldwide media outlets that the private personal information of 26.5 million veterans 
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discharged after 1975 had been disclosed. The private personal information of these veterans 
disclosed included names, dates of birth. Social Security numbers, disability ratings, and 
upon information and belief, certain medical information. 

16. Secretary Nicholson reported the disclosure was connected to an alleged burglary 
of the home of Defendant John Doe. Upon information and belief, on or about May 3, 2006, 
John Doe, a low-ranking data analyst and long-time VA employee, had removed from the 
VA facility VA files containing private personal information of 26.5 million persons 
comprised of veterans discharged since 1975 and as many as 1.1 million active-duty military 
personnel. 430,000 National Guard members and 645,000 reserve members and had taken 
the files to his home. John Doe then copied the files onto his computer and/or external disks 
for an unspecified purpose. John Doe's computer and/or disks v^ere allegedly stolen during a 
burglary of his home. Upon information and belief, these items have not been recovered as of 
the date of the filing of this Complaint. They are not believed to be encrypted or password 
protected and can be easily accessed and duplicated. 

17. Upon information and belief, John Doe was able to easily access computer files 
containing private personal information of 26.5 million veterans and copy the files irom the 
VA's system onto external disks and his personal computer. Upon further information and 
belief, John Doe had been removing the data from the VA facility for a period of three years 
in a practice expressly or implicitly ratified by the VA. John Doe's access to and duplication 
of this information was a disclosure in violation of 5 U.S.C. § 552a(b) and the result of 
Defendants' willful and intentional failure to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 
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552a(eX10). 

18. Upon information and belief, VA officials knew about the theft within hours of 
the crime but did not inform Secretary Nicholson until 13 days later. Upon learning of the 
above-described disclosures, Secretary Nicholson and Deputy Secretary Mansfield 
unreasonably delayed reporting the disclosures to law enforcement agencies despite 
knowledge of the imminent and substantial risk of serious harm to the personal security of 
the affected veterans. VA Inspector General George Opfer publicly stated that he was never 
formally notified of the disclosures, but rather heard about it through "gossip." 

19. Three weeks after the alleged burglary. Secretary Nicholson advised media 
outlets that the 26.5 million veterans whose private personal information was disclosed were 
subject to a heightened risk for identity theft. He urged the veterans to be "extra vigilant and 
to carefully monitor bank statements, credit card statements and any statements relating to 
recent financial transactions." Upon information and belief, Defendants have not provided 
credit protection and credit monitoring for Plaintiff and Class Members. In the meantime, 
John Doe has been fired. His boss resigned last week and another senior VA official is on 
administrative leave pending investigations by the FBI, the VA inspector general and 
Montgomery County police. 

20. Defendants knew or should have known that their computer security practices 
were not in compliance with 5 U.S.C. § 522a as well as other federal laws relating to 
information security. In 2003, a study conducted by the General Accounting Office (GAO) 
gave the VA a failing grade for its computer security practices. In March 2006, the United 
States House of Representafive's Committee on Government Reform gave the VA an "F" in 
its annual report card relating to information security. Despite this ample and specific notice 
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of noncompliance and the potential adverse effect of random and unauthorized disclosures of 
personal information. Defendants failed to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 
552a(e){10). 

21. The unauthorized and unconsented disclosure of an individual's name, address, 
date of birth and Social Security number creates a substantial risk of identity theft. An 
individual's Social Security number is the most usefiil identifier for retrieving information 
from public record databases, financial institutions and credit bureaus. Armed with an 
individual ' s name, address, date of birth and Social Security number, an identity thief is able 
to quickly and easily steal an identity, whereas, without such information, the task is difficult, 
time consuming and costly. 

22. Recent nationwide studies confirm that, on average, victims of identity theft 
spend hundreds of hours in personal time and hundreds of dollars in personal funds to resolve 
their credit issues. See uhaha'. idtheftcenter.org ; www.fte.org . 

23. Defendants' unauthorized and unconsented disclosures of Plaintiffs and Class 
Members' private personal information and the imminent and substantial risk of identity theft 
to which Plaintiff and Class Members have been exposed is the direct result of Defendants' 
failure to: (1) establish appropriate administrarive, technical and physical safeguards to 
ensure the security and confidentiality of records; (2) to protect against any anticipated 
threats or hazards to the security and integrity of these records; and (3) to promptly take 
reasonable measures to correct the disclosures, including but not limited to, providing law 
enforcement and the affected veterans with prompt and accurate notice of the disclosures. 
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24. The Defendants' loss of Plaintiff's and Class Members' private personal 
information is unprecedented in scope and raises concerns about the safety of U.S. military 
forces. For example, the Plaintiff's and Class Members' private personal information could 
be used to find out where military personnel live. As a direct and proximate result of 
Defendants' acts and omissions, Plaintiff and Class Members have been exposed to a risk of 
substantial harm and inconvenience, and have incurred or will incur actual damages in 
purchasing comprehensive credit reports and/or monitoring of their identity and credit. 

V. CLASS ALLEGATIONS 

25. Plaintiff maintains this action on behalf of himself and all individuals whose 
private personal information, including Social Security numbers, were disclosed by 
Defendants in May 2006 as described above. 

26. The members of the putative class are so numerous that joinder of individual 
claims is impracticable. Moreover, there are significant questions of fact and issues of law 
common to the members of the putative class. These issues include whether Defendants 
failed to establish appropriate administrative, technical and physical safeguards to ensure the 
security and confidentiality of records and to protect against known and anticipated threats or 
hazards to the security and integrity of these records, whether such failure was willful and 
intentional, whether the putative class members were adversely affected, and whether they 
incurred actual damages as result. 

27. Plaintiffs claims are typical of the claims of the putative class. Plaintiff and all 
members of the putative class have been adversely affected and damaged in that his private 
information has been compromised and stolen. 

28. The proposed class representative will fairly and adequately represent the 
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putative class because he has the class members' interest in mind, his individual claims are 
co-extensive with and identical to those of the class, and because he is represented by 
qualified counsel experienced in class action litigation of this nature. 

29. A class action in this instance is superior to other available methods for the fair 
and efficient adjudication of these claims since individual joinder of the claims of all 
members of the putative class is impracticable. Most members of the class are without the 
financial resources necessary to pursue this matter. Even if some members of the class could 
afford to litigate their claims separately, such a result would be unduly burdensome to the 
courts in which the individualized cases would proceed. Individual litigation increases the 
lime and expense of resolving a common dispute concerning Defendants' actions toward an 
entire group of individuals. Class action procedures allow for far fewer management 
difficulties in matters of this type and provide the unique benefits of unitary adjudication, 
economy of scale and comprehensive supervision over the entire controversy by a single 
court. 

30. The putative class may be certified pursuant to Rule 23(b)(1) of the Federal Rules 
of Civil Procedure because inconsistent or varying adjudications with respect to individual 
class members would establish incompatible standards of conduct for Defendants to follow. 

3 1 . The putafive class may be certified pursuant to Rule 23(b)(2) of the Federal Rules 
of Civil Procedure because Defendants have acted on grounds generally applicable to the 
putative class thereby making final injunctive relief and corresponding declaratory relief 
appropriate with respect to the claims raised by the class. 

32. The putative class may be certified pursuant to Rule 23(b)(3) of the Federal Rules 
of Civil Procedure because questions of law and fact common to class members will 
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predominate over questions affecting individual members and a class action is superior to 

other methods for fairly and efficiently adjudicating the controversy and causes of actions 

described in the Complaint. 

VI. STATEMENT OF CLAIMS 
COUNT ONE 

33. Plaintiffrepeats and reaffirms the assertions of fact contained in paragraphs 1 
through 32 herein above. 

34. The foregoing acts and omissions of Defendant VA constitute an unauthorized, 
nonconsensual, and inappropriate disclosure of Plaintiff s Social Security number in 
violation of 5 U.S.C. § 552a{b). 

COUNT TWO 

35. Plaintiffrepeats and reaffirms the assertions of fact contained in paragraphs 1 
through 34 herein above. 

36. The foregoing acts and omissions of Defendant VA constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of Plaintiff s private personal records in violation of 5 U.S.C. § 552a{e)(10). 

COUNT THREE 

37. Plaintiffrepeats and reaffirms the assertions of fact contained in paragraphs 1 
through 36 herein above, 

38. The foregoing acts and omissions of Defendants Nicholson, Mansfield and John 
Doe constitute a violation of Plaintiff s right to privacy in his Social Security number under 
the Fourth and Fifth Amendments to the United States Constitution. 

COUNT FOUR 
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39. Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 38 herein above. 

40. The foregoing acts and omissions of Defendants Nicholson, Mansfield and John 
Doe constitute a violation of Plaintiffs right to personal security under the Fourth and Fifth 
Amendments to the United States Constitution. 

COUNT FIVE 

4 1 . Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 40 herein above. 

42. The foregoing acts and omissions of Defendants Nicholson, Mansfield and John 
Doe deprived Plaintiff of his right to procedural and substantive due process under the Fifth 
Amendment to the United States Constitution. 

COUNT SIX 

43 . Plaintiff repeat and reaffirms the assertions of fact contained in paragraphs 1 
through 42 herein above. 

44. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe were done in deliberate indifference to rights guaranteed to Plaintiff under the 
Fourth and Fifth Amendments to the United States Constitution. 

VII. PRAYER FOR RELIEF 

WHEREFORE, Plainfiff, onbehalf of himself and all others similarly situated, 
hereby demand judgment against Defendants as follows: 

a. For a declarafion that Defendants' acts and omissions constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
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veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of these records in violation of 5 U.S.C. § 552a(e)(10) and the Fourth and Fifth 
Amendments of the United States Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting and 
preventing Defendants from continuing to operate without appropriate safeguards to ensure 
the security and privacy of veteran records and to protect against anticipated threats or 
hazards to the security and integrity of these records, and an identity and/or credit monitoring 
program for the benefit of Plaintiff and the proposed class under the Court's supervision to 
safeguard against the serious harm attendant to the improper disclosure/theft of confidential 
information; 

c. For an award of damages for Plaintiff and each affected class member in an 
amount no less than $ 1,000.00 as well as an identity and/or credit monitoring program for 
the benefit of Plaintiff and the proposed class under the Court's supervision to safeguard 
against the serious harm attendant to the improper disclosure/theft of confidential 
information; 

d. For an award of reasonable attorney fees and costs incurred by Plaintiff and the 
members of the putative class in prosecuting this matter; and 

e. For an award of such other relief in law and equity to which Plaintiff and the 
members of the putative class may be entitled under the premises. 
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DATED: June 9, 2006 




lason 
DC Bar #4 18073 
The Mason Law Firm, P.C. 
1225 19"^ Street, NW 
Suite 500 

Washington, D.C. 20038 
Telephone: (202) 429-2290 
Facsimile: (202) 429-2294 

Alexander E. Bamett 
The Mason Law Firm, P.C. 
One Pennsylvania Plaza 
Suite 4632 

New York, NY 10119 
Telephone: (212) 362-5770 
Facsimile: (917) 591-5227 

Peter N.Wasylyk 

The Law Offices of Peter N. Wasylyk 

1307 Chalkstone Avenue 

Providence, Rl 02908 

Telephone: (401) 831-7730 

Facsimile; (401) 861-6064 

Andrew S. Kierstead 

The Law Office of Andrew S. Kierstead 

1001 S.W. Fifth Avenue 

Portland, OR 97204 

Telephone: (508) 224-6246 

Facsunile: (508) 224-4356 

Counsel for Plaintiff 
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